The Eclipse Jetty HTTP/1.1 parser incorrectly terminates parsing of chunk extensions when a quoted string is not closed, treating the CRLF inside the string as a boundary. This flaw enables an attacker to embed a second HTTP request within a single connection by sending a crafted chunked request. The smuggled request is processed downstream without being seen by the front‑end proxy, allowing the attacker to potentially bypass authentication checks or other controls.

Products impacted are those that include the Eclipse Jetty web server. Versions of Jetty before the published fix are potentially vulnerable. No specific version range is documented in this advisory.

The CVSS v3 score of 7.4 indicates high severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The flaw can be exploited remotely by anyone with network access to the Jetty instance; no authentication or local privileges are required. An attacker can issue a single HTTP request containing a malformed chunk extension to trigger the smuggling behavior, potentially bypassing authorisation or affecting request routing.